Skip to main content

​
Why ISO 14971 Matters

ISO 14971 represents the global consensus on how manufacturers should systematically manage risks associated with medical devices. Regulatory authorities in the United States (FDA), Europe (MDR/IVDR), Canada (Health Canada), Japan (PMDA), and other markets recognize ISO 14971 compliance as evidence of due diligence in risk management. The standard differs from ISO 26262 in critical ways:
  • Scope: Covers all risks (not just safety-related malfunctions) including use error, biocompatibility, cybersecurity, and environmental hazards
  • Risk Acceptance: Requires benefit-risk analysis when risks cannot be reduced further — accepts that some residual risk may remain if benefits outweigh harm
  • Lifecycle Coverage: Mandates post-market surveillance and continuous risk management throughout product life, not just development phases
  • Probability Model: Uses a two-stage probability assessment (P1 × P2) to separately evaluate hazardous situation occurrence and harm occurrence

​
The ISO 14971 Risk Management Process

ISO 14971 structures risk management into five continuous phases: diagram

​
Use Step → Hazard → Hazardous Situation → Harm Hierarchy

ISO 14971 employs a four-level analytical structure that systematically traces how medical device usage can lead to patient harm:
LevelDefinitionExample (Patient Monitoring Device)
Use StepNormal or reasonably foreseeable user action in device workflowICU nurse connects patient to continuous heart rate monitor
HazardPotential source of harm inherent to the device or situationElectrical energy present in sensor leads
Hazardous SituationCircumstance where person/property exposed to one or more hazardsDamaged insulation exposes patient to electrical current
HarmPhysical injury or damage to health (including death)Patient receives electrical shock causing cardiac arrest
TestAuto2’s Risk Control Plan Risksheet implements this hierarchy using a four-level column structure with zoom controls. Level 1 represents Use Steps, Level 2 contains Hazards, Level 3 shows Hazardous Situations, and Level 4 documents potential Harms. This hierarchical approach enables systematic analysis — each Use Step may have multiple associated Hazards, each Hazard can create multiple Hazardous Situations depending on context, and each Hazardous Situation may cause different severities of Harm.
A common mistake is conflating “hazard” with “hazardous situation.” The hazard is the potential source of harm (e.g., sharp edge, electrical energy, incorrect dosage calculation). The hazardous situation is the specific scenario where a person is exposed to that hazard (e.g., user contacts sharp edge during cleaning, patient connected to device with damaged insulation). One hazard can create many hazardous situations depending on operational context.

​
Two-Stage Probability Model (P1 × P2)

Unlike FMEA’s single occurrence rating, ISO 14971 divides probability into two independent assessments: 
P1: Probability that the hazardous situation occurs
    (Given normal or foreseeable use, how likely is the exposure scenario?)

P2: Probability that the hazardous situation leads to harm
    (Given the hazardous situation exists, how likely is injury?)

Overall Probability = P1 × P2
Example — Defibrillator Electrode Misplacement:
  • P1 (Hazardous Situation Occurrence): Probability that electrodes are placed incorrectly during emergency use = Medium (E.g., 1 in 100 uses in stressful conditions)
  • P2 (Harm Given Situation): Probability that incorrect placement prevents successful defibrillation = Medium (E.g., 1 in 10 incorrect placements cause failure)
  • Combined Probability: Medium × Medium = Medium-Low overall probability of harm
This two-stage model allows targeted risk control strategies. If P1 is high, improve user interface design or training to prevent the hazardous situation. If P2 is high but P1 is low, focus on protective measures that reduce harm severity when exposure occurs. TestAuto2’s Risk Control Plan Risksheet provides separate fields for P1_PreControl, P2_PreControl, P1_PostControl, and P2_PostControl, along with formulas that automatically compute preRisk and postRisk values using configurable probability-severity matrices.

​
Risk Control Hierarchy and ALARP Principle

ISO 14971 Clause 6.2 mandates a three-tier hierarchy for risk control options:
  1. Inherent Safety by Design (preferred): Eliminate hazards through design choices before protective measures are needed (e.g., use non-toxic materials, design connectors that prevent mis-connection, select voltage levels that cannot cause shock)
  2. Protective Measures in the Device: If inherent safety is insufficient, add safeguards within the device itself (e.g., fuses, interlocks, redundant sensors, alarm systems)
  3. Information for Safety: If residual risk remains, provide information to users (e.g., warnings, training materials, instructions for use, contraindications)
The standard requires manufacturers to apply controls in this order — each level is only acceptable if higher-priority options are not feasible.
Relying solely on warnings or instructions without first attempting inherent safety or protective measures typically does not demonstrate compliance with ISO 14971. Regulators expect evidence that higher-priority controls were considered and justification for why they were not feasible.
After implementing risk controls, ISO 14971 requires reassessment of residual risk. If residual risk exceeds acceptance criteria but cannot be further reduced without compromising device functionality or introducing new risks, manufacturers must perform benefit-risk analysis per Annex C. This analysis documents that the medical benefits of the device outweigh the residual risks. TestAuto2 implements this workflow through progressive Risksheet views: “Identify Risks” (initial hazard identification), “Initial Evaluation” (P1/P2/Severity/preRisk assessment), “Measures” (link risk controls and select control type), “Residual Evaluation” (P1/P2/Severity/postRisk reassessment), and benefit-risk decision fields (benefit, additionalControlsPossible, riskBenefitResult, finalRisk).

​
Risk Acceptability and Benefit-Risk Analysis

ISO 14971 requires manufacturers to define risk acceptance criteria in the Risk Management Plan before beginning analysis. These criteria typically include:
  • Individual Risk Criteria: Maximum acceptable risk for any single hazardous situation (often expressed as probability-severity matrix boundaries)
  • Overall Residual Risk Criteria: Maximum acceptable cumulative risk across all hazardous situations for the device
  • Benefit-Risk Threshold: Conditions under which benefit-risk analysis can justify acceptance of risks exceeding individual criteria
When residual risk remains in the “ALARP region” (As Low As Reasonably Practicable) — meaning further risk reduction is possible but at disproportionate cost or would compromise device effectiveness — the manufacturer must document:
  1. What additional risk controls were considered and why they were rejected
  2. The clinical or therapeutic benefits the device provides
  3. Whether benefits outweigh the residual risk
  4. Whether alternative treatments with better risk/benefit profiles exist
TestAuto2’s Risk Control Plan Risksheet provides dedicated columns for this analysis: additionalControlsPossible (yes/no enum indicating if further controls are technically feasible), benefit (free-text field documenting clinical benefits), and riskBenefitResult (enum: acceptable/unacceptable/requires review). The finalRisk field captures the ultimate acceptance decision after considering all factors.

​
Traceability Requirements

ISO 14971:2019 Clause 3.4 requires traceability between:
  • Hazards → Hazardous Situations → Harms (documented in risk analysis)
  • Hazardous Situations → Risk Controls (documented via mitigates link role)
  • Risk Controls → Verification Evidence (documented via linked test cases using verifies link role)
  • Risk Controls → Requirements (documented via backlinks showing which system/design requirements implement the control)
TestAuto2 enforces these relationships through the RTM domain model and provides automated traceability checking via the Risk Control Effectiveness Report. The report identifies:
  • Risk controls without linked failure modes/hazards (orphaned controls)
  • Risk controls without verification evidence (missing test cases)
  • Risk controls without requirement linkage (implementation gaps)
  • Residual risks exceeding acceptance criteria (requiring benefit-risk analysis)

​
Post-Market Surveillance and Production Risk Management

Unlike standards focused solely on development phases, ISO 14971 requires continuous risk management throughout the product lifecycle:
  • Production and Post-Production Information (Clause 9): Manufacturers must establish systematic processes to collect and review field data (complaints, adverse events, near-misses, user feedback)
  • Trend Analysis: Identify patterns suggesting previously unrecognized hazards or changing risk profiles
  • Risk Management File Updates: When new information reveals unacceptable risks, update the risk analysis and implement additional controls
TestAuto2 supports this through custom fields that track risk evolution: initialRisk (as-designed risk from development), residualRisk (post-control risk at release), and workflow states that enable “published” documents to be returned to “inReview” when field data requires reassessment.

​
Integration with ISO 26262 for Medical Mobility Applications

Projects serving both automotive safety (ISO 26262) and medical device (ISO 14971) requirements — such as patient transport systems, medical emergency vehicles, or accessibility mobility devices — must satisfy both frameworks. TestAuto2 enables dual-standard compliance by:
  • Shared Hazard Identification: Same hazard work items can be analyzed under both ISO 26262 HARA (with S-E-C-ASIL fields) and ISO 14971 (with P1-P2-Severity-Risk fields)
  • Unified Traceability: Single RTM domain model links hazards to safety goals (ISO 26262) and to Use Steps/Harms (ISO 14971)
  • Complementary Risk Assessments: FMEA-based failure mode analysis (AIAG-VDA/ISO 26262) addresses malfunction scenarios, while ISO 14971 captures use errors, human factors, and environmental hazards outside the FMEA scope
  • Consolidated Risk Control Plans: Single Risksheet configuration supports both risk control type classifications (ISO 26262 categories: inherent safety, protective measures, information for safety) and verification evidence requirements from both standards
For practical guidance on creating and managing ISO 14971 risk analysis documents, see Create a HAZID Document and Link to Risk Controls. For reference details on the Risk Control Plan Risksheet structure, see Risk Control Plan Risksheet Configuration.